3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aac

Analysis

max time kernel
116s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aacN.exe
Size

264KB
MD5

d888376a23f2af5f6dda24e95fc5b0a0
SHA1

691c5532c9a9bd2c61e9d763c2cd07a4568a4f20
SHA256

3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aac
SHA512

01d4e46325df32666fa22e6d786cd0d1a95b7968a7d5606ba4e305baf4430c6903035b66fb4df5bf53df426c9e5d4a3cfaf8a11a50cd884be5f41bd551bcd64e
SSDEEP

3072:6klDYDrrTD8GenSH63SatZTCafBMK4rxHUQ58KpVfW:6k+DrrTD8GenC63lbjaKuNUWpB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aacN.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
1608	msedge.exe
1608	msedge.exe
3516	identity_helper.exe
3516	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1608	1372	3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aacN.exe	84
PID 1372 wrote to memory of 1608	1372	3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aacN.exe	84
PID 1608 wrote to memory of 1392	1608	msedge.exe	85
PID 1608 wrote to memory of 1392	1608	msedge.exe	85
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 3648	1608	msedge.exe	86
PID 1608 wrote to memory of 448	1608	msedge.exe	87
PID 1608 wrote to memory of 448	1608	msedge.exe	87
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88
PID 1608 wrote to memory of 4352	1608	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aacN.exe
"C:\Users\Admin\AppData\Local\Temp\3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aacN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aacN.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x84,0x108,0x7ffef21e46f8,0x7ffef21e4708,0x7ffef21e4718
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15817427039223558342,17808902887321201983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3601f2af3e32cbff553e77449eebe655a972a796e5eec824ca3d333b50da1aacN.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef21e46f8,0x7ffef21e4708,0x7ffef21e4718
    3⤵
    PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
fec718595c8a00215ef6993f02701b2f

SHA1
3ebcbf2dc8320b9477851c12edddc123f25b1c43

SHA256
996c147b677201f934ad03ca3c11278f85b0b8d1b8cd69769e1e33ef82bf9374

SHA512
8876534499305214c42863e10c769c08779f42ab08f28a052239fc1b2f75b6bf9776cf882e8e9bee1732650d4a02110c009b13130e7df8a575c2add4d49c33a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd7682af75ba8f66441ed242107762f7

SHA1
4f3ef8c8731705a09b8f59ca5d75cbda9a6f9c75

SHA256
26b03eef2c9ccf3b2177a42643267b2518a601f2463ce3ee4762985b12bbaa64

SHA512
4c685b4c96d8545d5490bef612b04afdb2760d2cb675702a616bffe900ec68ca11aacdac865b5ce4b2928e7bb51233ddcd672fbad8a29e0dd9b4229640c5fa9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
82ce7cceab6de6f74d54807e0ce296ed

SHA1
e00406ae0d42110ab961cd466c0d8eb2b04b205a

SHA256
2aafd5337cdd0029e0c122a9071814fc6e0967c865937fd14c72ec41ffdc9d62

SHA512
793dd228afbf4537637a8e23ca91b09219e4da7007dc52a6bd6821b219258e0e40581074491e1c2b9c330dcb5944ad44dcbba75b0f8e8b0cdf3494677f6a4d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0be2d7a512490b4519e2853748745be3

SHA1
fb1cf68ef70913cddf175fc7762319e9899d6cf4

SHA256
4b8bc712409f715c4b9014fc6bbdb12d82eff32d3dc635243517063ee1b852a0

SHA512
103f6ec4c294501d5cca336a1be72c4449ed2fdf84f2f9b0f09d2a52962ff11ea6e827314d6debad9e4d328f77f4a44523c7f7e8ffd890d8c22965610d3e5d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1ebb36e8a50486801ee3547f8907043b

SHA1
eb166010e85a9c52ac837fe36aaf4ec0698e1c85

SHA256
0428e434a91906bd7bcd43e6a7300ea2ff8a6933302d580accd9c8d42f90c5f1

SHA512
3f6e16b19eedda482a752f31d73773b93f4dd4b8ac4ba24b091006b92425dc1fdbc44195e30bfc76183a9a28725672ff5032ba474a4b687108353383370c0edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581529.TMP

Filesize
371B

MD5
2fdc9d7feda87ec66e59ec3072f98497

SHA1
a85680d45a64f272e4ceee9efa584f7b2c5b272d

SHA256
ab4ac242bf227452db8ec46b430bc0ebdcba3757a237046e3962a9a6154d4605

SHA512
41e94ed7ee6c5c48d91356387f67aa7f8f0a8ee76555a1167447c0fae78c7d6bd19df344d71b868f7f45eee6a6a61fbf1365352c992e19e1b1a0ac99c68feff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3263847e62227c4118f546adcbd3763f

SHA1
6581e01579d32faf88571d23b37a69e60fc70210

SHA256
882c88f03e6a1c6699bd0318c88916134e4be90c4e5e670cff59b0123f23b0b0

SHA512
0a969899c84d0a6a9e2612c020dd33490ccd875b366f518b773aaa2568778f06b5f6bcd37d806386e9a257f2e358c78241b9c919b8458cea84b0a06e10ee1e3c

Download Submit